feat: drop support for node <20.18 (#1209)

fixes #1081

---------

Signed-off-by: Jan Kowalleck <[email protected]>

Author: jkowalleck

.github/workflows/nodejs.yml

@@ -158,13 +158,10 @@ jobs:
           - "23"      # current
           - "22"      # active LTS
           - "20"
-          - "18"
-          - "16"
-          - "14"
-          - "14.0.0"  # lowest supported
+          - "20.18.0" # lowest supported
         os:
           - ubuntu-latest
-          - macos-13 # macos-latest has issues with node14
+          - macos-latest
           - windows-latest
     timeout-minutes: 10
     steps:
@@ -186,18 +183,9 @@ jobs:
           '23' | '22')
             npm i -g npm@^11
             ;;
-          '20' | '18')
+          '20' | '20.18.0')
             npm i -g npm@^10
             ;;
-          '16')
-            npm i -g npm@^9
-            ;;
-          '14')
-            npm i -g npm@^8
-            ;;
-          '14.0.0')
-            npm i -g npm@^7
-            ;;
           esac
       - name: setup project
         shell: bash
@@ -211,26 +199,6 @@ jobs:
           # and might utilize `npm_config_engine_strict=false` 
           
           dev_constraints=' npm-run-all2 c8 mocha fast-glob rimraf '
-          # as long as npm cannot auto-resolve engine-constraints, we need to help here
-          case "$NODE_VERSION" in
-            '16')
-              dev_constraints="${dev_constraints/ c8 / c8@^9 }"
-              dev_constraints="${dev_constraints/ rimraf / rimraf@^4 }"
-              export npm_config_engine_strict=false
-              ;;
-            '14')
-              dev_constraints="${dev_constraints/ c8 / c8@^9 }"
-              dev_constraints="${dev_constraints/ npm-run-all2 / npm-run-all2@^5 }"
-              dev_constraints="${dev_constraints/ rimraf / rimraf@^4 }"
-              export npm_config_engine_strict=false
-              ;;
-            '14.0.0')
-              dev_constraints="${dev_constraints/ c8 / c8@^8 }"
-              dev_constraints="${dev_constraints/ npm-run-all2 / npm-run-all2@^5 }"
-              dev_constraints="${dev_constraints/ rimraf / rimraf@^4 }"
-              export npm_config_engine_strict=false
-              ;;
-          esac
           echo "::group::install prod"
           npm_config_engine_strict=false npm i --ignore-scripts --include=optional --omit=dev --only=prod --production --loglevel=silly
           echo "::endgroup::"
@@ -396,7 +364,7 @@ jobs:
         include:
           - # lowest reasonable number that works
             typescript-version: '^4.0'
-            nodeTypes-version: '^14'
+            nodeTypes-version: '^20'
             js-type: 'cjs'
     env:
       EXAMPLE_DIR: examples/node/typescript/example.${{ matrix.js-type }}

HISTORY.md

@@ -6,10 +6,14 @@ All notable changes to this project will be documented in this file.
 
 <!-- add unreleased items here -->
 
+* BREAKING Changes
+  * Dropped support for `node<=20.18.0` ([#1081] via [#1209])
 * Build
   * Use _TypeScript_ `v5.7.3` now, was `v5.7.2` (via [#1204])
 
+[#1081]: https://github.com/CycloneDX/cyclonedx-javascript-library/issues/1081
 [#1204]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1204
+[#1209]: https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1209
 
 ## 7.1.0 -- 2025-01-09
 

README.md

@@ -130,6 +130,12 @@ See the shipped `package.json` for version constraints.
   * [`libxmljs2`](https://www.npmjs.com/package/libxmljs2)  
   * the system might need to meet the requirements for [`node-gyp`](https://github.com/TooTallNate/node-gyp#installation), in certain cases.
 
+## Requirements
+
+* `node`: `>=20.18`
+
+However, there are older versions of this library which support `node>=14.0.0`
+
 ## Usage
 
 See extended [examples].

examples/web/webpack/package.json

@@ -7,10 +7,10 @@
   },
   "devDependencies": {
     "webpack": "^5",
-    "webpack-cli": "^5"
+    "webpack-cli": "^5||^6"
   },
   "scripts": {
     "build": "webpack build",
-    "example": "www-browser dist/index.html"
+    "example": "x-www-browser dist/index.html"
   }
 }

package.json

@@ -77,7 +77,7 @@
   ],
   "type": "commonjs",
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=20.18.0"
   },
   "dependencies": {
     "packageurl-js": "^2.0.1",
@@ -87,23 +87,23 @@
     "ajv": "^8.12.0",
     "ajv-formats": "^3.0.1",
     "ajv-formats-draft2019": "^1.6.1",
-    "libxmljs2": "^0.31 || ^0.32 || ^0.33 || ^0.35",
+    "libxmljs2": "^0.35",
     "xmlbuilder2": "^3.0.2"
   },
   "devDependencies": {
     "@types/mocha": "^10",
     "@types/node": "ts5.6",
     "@types/spdx-expression-parse": "^3",
-    "c8": "^8||^9||^10",
+    "c8": "^10",
     "deepmerge": "^4.2.2",
     "fast-glob": "^3.3.1",
-    "mocha": "10.8.2||11.1.0",
-    "npm-run-all2": "^5||^6",
-    "rimraf": "^4||^5",
+    "mocha": "11.1.0",
+    "npm-run-all2": "^7",
+    "rimraf": "^6",
     "ts-loader": "9.5.1",
     "typescript": "5.7.3",
     "webpack": "5.97.1",
-    "webpack-cli": "5.1.4||6.0.1",
+    "webpack-cli": "6.0.1",
     "webpack-node-externals": "3.0.0"
   },
   "browser": "./dist.web/lib.js",

src/_optPlug.node/__jsonValidators/ajv.ts

@@ -20,7 +20,7 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
 import Ajv, { type Options as AjvOptions } from 'ajv'
 import addFormats from 'ajv-formats'
 /* @ts-expect-error TS7016 */
-import * as addFormats2019 from 'ajv-formats-draft2019'
+import addFormats2019 from 'ajv-formats-draft2019'
 import { readFile } from 'fs/promises'
 
 import type { ValidationError } from '../../validation/types'

src/_optPlug.node/errors.ts

@@ -18,7 +18,7 @@ Copyright (c) OWASP Foundation. All Rights Reserved.
 */
 
 export class OptPlugError extends Error {
-  readonly cause: any | undefined
+  override readonly cause: any | undefined
 
   constructor (message: string, cause?: any) {
     super(message)

src/spdx.ts

@@ -17,7 +17,7 @@ SPDX-License-Identifier: Apache-2.0
 Copyright (c) OWASP Foundation. All Rights Reserved.
 */
 
-import * as spdxExpressionParse from 'spdx-expression-parse'
+import spdxExpressionParse from 'spdx-expression-parse'
 
 /* @ts-expect-error: TS6059 -- this works as long as the file/path is available in dist-package. */
 import { enum as _spdxSpecEnum } from '../res/schema/spdx.SNAPSHOT.schema.json' with { type: 'json' }

tools/code-style/package.json

@@ -3,7 +3,7 @@
   "name": "@cyclonedx/cyclonedx-library-code-style",
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=20"
+    "node": ">=20.18"
   },
   "dependencies": {
     "@eslint/eslintrc": "3.2.0",

tools/docs-gen/package.json

@@ -3,7 +3,7 @@
   "name": "@cyclonedx/cyclonedx-library-docs-gen",
   "license": "Apache-2.0",
   "engines": {
-    "node": ">=20"
+    "node": ">=20.18"
   },
   "dependencies": {
     "typedoc": "^0.27.2",